🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: gnu.emacs.vm.bug
Article #649

Re: Unsafe tmp files

#649
From: Michael Welle
Date: Thu, 02 Sep 2004 06:49
42 lines
2818 bytes
Hi Kevin,

Kevin Rodgers <ihs_4664@yahoo.com> writes:

> Michael Welle wrote:
>  > vm seems to create world readable tmp files under some conditions. If
>  > I read an email with an image attached, tmp files are created. If the
>  > image is a jpeg for example, the tmp files are chmod 600. That is the
>  > expected behaviour. But if the image is a png, some tmp files are
>  > chmod 644 and these files are not deleted after finishing vm. This is
>  > rather annoying. Any hints?
>
> Are you sure the attachments are PNG files?  (What are their
> Content-Type and Content-Disposition headers?)
the attachments are png files, if I can trust the file cmd.

Content-Type: image/png
Content-Disposition: inline; filename="Bildschirmphoto1.png"


> Assuming they're image/png MIME attachments, are they being converted
> to some other format, via `vm-mime-type-converter-alist' or
> `vm-mime-image-type-converter-alist'?
No, I have set this variable only for text/html.


> `vm-mime-use-image-strips' defaults to t.  Does the problem occur if
> you set it to nil?
Ah, that seems to be much better. There is only a tmp file with
restricted permissions. I have looked at the code yesterday and find
the place with the stripping. But my knowledge about list is very
vague. Is the handling of png images so different from the handling of
other image types?


> Does the problem occur if you clean out the temp directory before
> selecting such a message (so that you can be sure the file didn't
> already exist with the wrong permission)?
The files are newly created every time an image is showed.

Thank you
Michael
Technical Details
Message-ID: <87fz61jhbp.fsf@buerbach048.buerbach.wohnheim.uni-siegen.de>
Path: arc1-ca.pugleaf.net!g2news1.google.com!news2.google.com!proxad.net!news.tele.dk!news.tele.dk!small.news.tele.dk!news-fra1.dfn.de!si-nic.hrz.uni-siegen.de!not-for-mail
References: <87n00bk4y9.fsf@buerbach048.buerbach.wohnheim.uni-siegen.de> <413607BA.8030706@yahoo.com>

Show Full Headers
Complete Article Headers
X-Google-Thread: f6829,95611224594b1d12
X-Google-Attributes: gidf6829,public
X-Google-Language: ENGLISH,ASCII-7-bit
Path: arc1-ca.pugleaf.net!g2news1.google.com!news2.google.com!proxad.net!news.tele.dk!news.tele.dk!small.news.tele.dk!news-fra1.dfn.de!si-nic.hrz.uni-siegen.de!not-for-mail
From: Michael Welle <m.welle@gmx.net>
Newsgroups: gnu.emacs.vm.bug
Subject: Re: Unsafe tmp files
Date: Thu, 02 Sep 2004 08:49:46 +0200
Organization: University of Siegen
Lines: 42
Message-ID: <87fz61jhbp.fsf@buerbach048.buerbach.wohnheim.uni-siegen.de>
References: <87n00bk4y9.fsf@buerbach048.buerbach.wohnheim.uni-siegen.de> <413607BA.8030706@yahoo.com>
NNTP-Posting-Host: si-nic.hrz.uni-siegen.de
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Trace: ws-fra1.win-ip.dfn.de 1094107785 22861 141.99.2.2 (2 Sep 2004 06:49:45 GMT)
X-Complaints-To: abuse@dfn.de
NNTP-Posting-Date: Thu, 2 Sep 2004 06:49:45 +0000 (UTC)
User-Agent: Gnus/5.090024 (Oort Gnus v0.24) XEmacs/21.4 (Native Windows TTY
 Support, linux)
Cancel-Lock: sha1:8r4f0qbOK9RuMUqG6dCK2McEj5A=
X-Original-NNTP-Posting-Host: 141.99.26.48
X-Original-Trace: 2 Sep 2004 08:49:41 +0200, 141.99.26.48